Differences

This shows you the differences between two versions of the page.

--- paloaltonetworks:troubleshooting:vpn [2020/11/13 10:39] – [IPSec VPN Troublshooting] bstafford
+++ paloaltonetworks:troubleshooting:vpn [2022/11/23 12:49] (current) – external edit 127.0.0.1
@@ Line 16: / Line 16: @@
 Remember, if you are setting up a VPN from site A which has a changeable IP address and site B which is static, you configure the IKE Gateway at Site B to use a dynamic peer. However, this will not work if you have a GlobalProtect gateway hosted on the same IP.
+===== VPN Tunnels Don't Come Up After Cutover =====
+Migrate from FortiGate to Palo Alto Networks firewalls. VPN tunnels do not work at all.
+  * Disabled the IPsec tunnels and the IKE gateways.
+  * Committed.
+  * Make a cup of tea and chilled for 15 minutes.
+  * Enabled the IPsec tunnels and the IKE gateways.
+  * Commited.
+  * 5 of the 6 tunnels came up immediatly. The 6th proved more difficult and was caused by something else.
+===== Remote Site not Getting Traffic With Proxy-ID =====
+An old Cisco ASA 5505 running an unknown version of IOS is at a remote site that runs a 192.168.0.0/24 network.
+ASA routes all traffic to the HQ firewall (Cisco ASA 5555) using "interesting traffic" filter 0.0.0.0/0.
+Palo Alto Networks PA-5220 running PAN-OS 9.1.8 has the VPN configured and is using a single Proxy-ID of "local:0.0.0.0/0,remote:192.168.0.0/24".
+Tunnel comes up straight away. We can see remote traffic coming to the PA-5220 and we can see the PA-5220 firewall returning traffic. Security policy rules and static routing working perfectly.
+However, return traffic to the ASA 5505 never reaches the 5505.
+Lots of troubleshooting later and we see that if we use any filter other than 0.0.0.0/0, then traffic flow works (e.g. 10.0.0.0/8). Obviously, this is useless as the remote site needs to browes the Internet through the HQ firewalls.
+More guessing games later and we reduce IKEv2 to IKEv1. Traffic starts working immediately.